Android: Multi-user access to system properties

Question

I'm facing an issue with permissions to write system properties in a multi-user scenario, specifically the fact that they are only available to the primary user ("owner").

In the check_perms method @ property_service.c the prefix of the property is mapped to a UID which is compared to that of the caller, but the userid bits are not masked out. This means that an app running as e.g. AID_SYSTEM will not be able to access system permissions granted for this UID when it's running as a secondary user.

I'm curious as to what is the reason for this limitation? Is this deliberate? Is there a security concern here that I am missing? If an app is allowed to run as system, doesn’t it make sense to grant it the same rights regardless of the current user of the device?

What makes me even more curious is that there is a previous patch that solves this issue for the AID_BLUETOOTH user specifically:

static int check_perms(const char *name, unsigned int uid, unsigned int gid, char *sctx){ [...]
 app_id = multiuser_get_app_id(uid); if (app_id == AID_BLUETOOTH) { uid = app_id; }

Is there a reason for not *always* using the app id rather than the full uid including user id bits when checking system property permissions?

I'm considering uploading a patch that either adds (app_id == AID_BLUETOOTH || app_id == AID_SYSTEM), or simply removes the check altogether (meaning always using the app id). Would that have any chance of being accepted?

Answer 1

There is no such thing as AID_SYSTEM running as a secondary user. AID_SYSTEM (as well as AID_BLUETOOTH and other such hard-coded uids) are not per-user uids, they are fixed uids for specific processes than run independently of the current user. For example, AID_SYSTEM is for the system process, which is the thing actually in charge of switching users and such.

The check in the property service is correct, since the point is to only allow these fixed uids to the operations.